Re: [PATCH v10 10/11] SELinux: Add selfattr hooks

[Casey Schaufler <casey@schaufler-ca.com>]

On 6/7/2023 3:32 PM, Paul Moore wrote:
> On Apr 28, 2023 Casey Schaufler <casey@schaufler-ca.com> wrote:
>> Add hooks for setselfattr and getselfattr. These hooks are not very
>> different from their setprocattr and getprocattr equivalents, and
>> much of the code is shared.
>>
>> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
>> Cc: selinux@vger.kernel.org
>> Cc: Paul Moore <paul@paul-moore.com>
>> ---
>>  security/selinux/hooks.c | 154 +++++++++++++++++++++++++++++++--------
>>  1 file changed, 124 insertions(+), 30 deletions(-)
>>
>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>> index 2ee92d3fb79d..e78b955e04f8 100644
>> --- a/security/selinux/hooks.c
>> +++ b/security/selinux/hooks.c
>> @@ -6542,6 +6559,81 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
>>  	return error;
>>  }
>>  
>> +static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
>> +			       size_t *size, u32 flags)
>> +{
>> +	char *value;
>> +	size_t total_len;
>> +	int len;
>> +	int rc;
>> +
>> +	len = selinux_lsm_getattr(attr, current, &value);
>> +	if (len < 0)
>> +		return len;
>> +
>> +	total_len = ALIGN(struct_size(ctx, ctx, len), 8);
>> +
>> +	if (total_len > *size)
>> +		rc = -E2BIG;
> Hmm.  Since we need to calculate the aligned @total_len value in the
> LSM specific code, perhaps it doesn't make sense to also do the
> alignment in lsm_fill_user_ctx().  My apologies, I know I was the one
> who suggested doing the alignment in a common place previously.

Some future user of lsm_fill_user_ctx() may not need to do the
calculation, so I would be inclined to leave it here. I'm thinking
SO_PEERCONTEXT, or the like. But I'll go with whatever gets the
patchset moving forward.

>
>> +	else if (ctx)
>> +		rc = lsm_fill_user_ctx(ctx, value, len, LSM_ID_SELINUX, 0);
>> +	else
>> +		rc = 1;
>> +
>> +	*size = total_len;
>> +	if (rc < 0)
>> +		return rc;
>> +	return 1;
>> +}
> --
> paul-moore.com